Use Touch ID for Sudo on Mac

Post by derefr » Mon, Mar 01, 2021, 8:58 PM UTC

unilynx wrote: post #174

samstave wrote: post #135

Earlier quoted context omitted.

You know =what would be cool: If all apps had to register their pref config files into a single dir and that would be tracked and snapshotted - and then you could just have ALL apps look to the same dir for where their configs come from and you could have a single repo for ALL apps on your or ANY system - and then you could walk up to a terminal and plug in your "license key" which said what apps you had access to an…

This was basically the idea behind the Windows registry - a single configuration store. With mostly the same tree structure on Machine and User level, so your local prefs could override machine-level prefs. The 'user' part was portable between machines on a domain. And you have a single API to access or change settings Opinions may differ on how well it was executed in practice. I'm not sure /etc/ with its hundreds o…

Post by toxik » Mon, Mar 01, 2021, 9:20 PM UTC

PureParadigm wrote: post #183

For my accounts I usually just allow sudo to work without prompting for password by using the NOPASSWD configuration option. This saves a lot of time if you need to use sudo frequently (in my case I use it for system upgrades). Unless I'm missing something, the security cost of this should be negligible, especially if you're in the habit of locking your computer screen when you're not using it (and this typically hap…

Post by andr0x » Mon, Mar 01, 2021, 9:41 PM UTC

superkuh wrote: post #185

You still have to provide a password. Fingerprints are not passwords. They are usernames.

Post by chipotle_coyote » Mon, Mar 01, 2021, 10:22 PM UTC

jeffbee wrote: post #122

derefr wrote: post #106

Earlier quoted context omitted.

Because, like ChromeOS/CoreOS, modern macOS now does image-based updates. A macOS update isn’t “whatever was previously on your OS volume, plus arbitrary patch X”; rather it’s “a new, fresh OS disk image, written to a separate APFS volume, with a fixed SHA, with update transfer-size optimized by composing said image partially from files in your current OS, but only in such a way that the volume will still hash the sa…

The thing that doesn't make sense here is that macOS discards randomly your settings, but it is also the only OS I use that regularly gets in a fucked up state where settings have to be nuked. I mean, here we are in year 37 of the mac and people are still zapping their PRAMs. The only improvement is you don't have to physically pull out the battery.

Post by mkskm » Mon, Mar 01, 2021, 10:26 PM UTC

jmarcher wrote: post #118

beyondcompute wrote: post #63

Earlier quoted context omitted.

I’ve just added this to my .bash_profile: enable-sudo-touchid() { sudo sed -i -e '1s;^;auth sufficient pam_tid.so\n;' /etc/pam.d/sudo } But probably automating the check (if the automated checker has the correct permission) would not be that hard.

A step further so you don't have to think about enabling it: sudo() { unset -f sudo if [[ "$(uname)" == 'Darwin' ]] && ! grep 'pam_tid.so' /etc/pam.d/sudo --silent; then sudo sed -i -e '1s;^;auth sufficient pam_tid.so\n;' /etc/pam.d/sudo fi sudo "$@" }

    function sudo --description "Execute a command as another user."
        if [ (uname) = "Darwin" ]
            set --local needle "^auth\b.*\bpam_\(reattach\|tid\|watchid\)\.so\$"
            if ! grep $needle --silent /etc/pam.d/sudo && \
                [ -f /usr/local/lib/pam/pam_reattach.so* ] && \
                [ -f /usr/local/lib/pam/pam_watchid.so* ]
            command sudo sh -c "
            cat /etc/pam.d/sudo
    auth optional pam_reattach.so
    auth sufficient pam_tid.so
    auth sufficient pam_watchid.so
    \$(grep -v '$needle' /etc/pam.d/sudo)
    EOF"; or return $status
            end
        end
        command sudo $argv
    end